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MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND, 
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SUBJECT:  Audit  Report  on  DoD  Year  2000  Computing  Problem  Reports:  Lessons 
Learned  From  the  Defense  Integration  Support  Tools  Database 
(Report  No.  98-169) 


We  are  providing  this  audit  report  for  your  use.  The  primary  purpose  is  to 
provide  the  DoD  Chief  Information  Officer  and  other  senior  DoD  managers  with  an 
independent  assessment  of  the  DoD  progress  related  to  year  2000  conversion  efforts. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing 
the  final  report.  You  concurred  with  all  the  draft  recommendations. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Mary  Lu  Ugone  at  (703)  604-9049  (DSN  664-9049)  or 
Mr.  James  W.  Hutchinson  at  (703)  6(M-9060  (DSN  664-9060).  See  Appendix  D  for 
the  report  distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  7.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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DoD  Year  2000  ComputingProblem  Reports: 
Lessons  Learned  From  the  Defense  Integration 
Support  Tools  Database 


Executive  Summary 


Introduction.  Information  technology  systems  have  ^ically  used  two  digits  to 
represent  the  year,  such  as  “98”  representing  1998,  to  conserve  electronic  data  storage 
and  reduce  operating  costs.  With  die  two-digit  format,  however,  the  year  2(XX)  is 
mdistinguishable  from  1900.  As  a  result  of  that  ambiguity,  computers  and  associated 
systems  and  application  programs  that  use  dates  to  calculate,  compare,  and  sort  could 
generate  incorrect  results  when  working  with  years  after  1999. 

This  report  is  one  of  a  series  of  reports  that  the  Inspector  General,  DoD,  is  issuing  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer,  DoD,  to 
monitor  DoD  efforts  to  address  the  year  2(XX)  computing  challenge. 

Audit  Objectives.  The  overall  audit  objective  was  to  identify  significant  time-sensitive 
issues  related  to  DoD  year  2(KX)  reporting  requirements  and  oversight  actions  and  to 
quickly  report  those  issues  to  senior  DoD  management.  Specifically,  we  evaluated  the 
problems  in  managing  the  Defense  Integration  Support  Tools  Database  and  how  DoD 
can  apply  the  lessons  learned  to  a  replacement  database. 

Audit  Results.  Currently,  DoD  has  no  viable  rqiository  of  year  2()(X)  information  that 
DoD  managers  can  use  for  tracking,  reporting,  monitoring,  and  overseeing  DoD  year 
2(X)0  compliance  efforts.  Previously,  DoD  used  the  Defense  Integration  Support  Tools 
Database  as  the  official  repository  of  DoD  year  2000  information,  but  discontinued  it 
for  year  2000  use.  Further,  DoD  managers  were  unable  to  rely  on  the  Defense 
Integration  Support  Tools  Database  for  reporting  and  oversight  purposes. 

Consequently,  DoD  managers  do  not  have  a  DoD-wide  automated  mechanism  for  year 
2000  reporting  and  oversi^t  purposes.  However,  the  DoD  Chief  Information  Officer 
has  recogruzed  the  importance  of  having  a  DoD-wide  inventory  of  systems  for  tracking 
and  reporting  year  2000  efforts  and  has  taken  action  to  develop  a  new  database  tool  to 
replace  die  Defense  Integration  Support  Tools  Database  for  year  2000  use. 

Summary  of  Recommendations.  We  recommend  an  immediate  replacement  database 
for  the  Defense  Integration  Support  Tools  Database  to  track,  monitor,  report,  and 
oversee  DoD  year  20(X)  efforts.  We  recommend  application  of  the  lessons  learned 
from  the  Defense  Integration  Support  Tools  Database  to  the  replacement  database. 
Specifically,  the  replacement  database  should  provide  reliable  information  for  tracking, 


monitoring,  reporting,  and  overseeing  DoD  year  2000  efforts;  allow  for  flexibility  to 
accommodate  changes  in  external  reporting  requirements;  provide  compatibility  with 
DoD  Con^nent  internal  databases  for  effective  importing  of  data;  and  include  controls 
for  entering  data  to  affix  responsibility  for  accuracy  at  the  DoD  Component  Year  2000 
designated  office  level. 

Management  Comments.  The  Assistant  Secretary  of  Defense  (Command,  Control, 
Commiinications,  and  Intelligence)  concurred  wifli  all  recommendations  and  described 
initial  actions  taken  to  implement  the  replacement  database  and  to  avoid  problems 
associated  with  the  prior  database.  See  Part  I  for  a  summary  of  management  comments 
and  Part  m  for  the  complete  text  of  the  comments. 

Audit  Response.  Management  comments  were  generally  responsive.  We  will  track 
implementation  of  the  new  database  and  of  the  reliability  of  inputs  to  that  database 
through  oin  continuing  audit  oversight  of  this  area,  as  well  as  normal  audit  followup 
procedures.  No  additional  comments  are  required. 
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Audit  Background 


The  year  2000  (Y2K)  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform 
date-related  functions  before,  on,  or  after  the  turn  of  the  next  century.  The 
Y2K  problem  is  rooted  in  the  way  that  dates  are  recorded  and  computed  in 
automated  information  systems.  For  the  past  several  decades,  systems  have 
typically  used  two  digits  to  represent  the  year,  such  as  “98”  representing  1998, 
to  conserve  electronic  data  storage  and  to  reduce  operating  costs.  With  the  two- 
digit  format,  however,  the  year  2000  is  indistinguishable  from  1900,  or  2001 
from  1901,  and  so  forth.  As  a  result  of  the  ambiguity,  system  or  application 
programs  ^t  use  dates  to  perform  calculations,  comparisons,  or  sorting  could 
generate  incorrect  results  when  working  with  years  following  1999.  Calculation 
of  Y2K  dates  is  further  complicated  because  the  Y2K  is  a  leap  year,  the  first 
centuiy  leap  year  since  1600.  The  computer  systems  and  applications  must 
recognize  February  29,  2000,  as  a  valid  date. 

Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  Y2K 
problem.  The  Executive  Order  also  requires  that  the  head  of  each  agency 
ensure  that  efrbrts  to  address  the  Y2K  problem  receive  the  highest  priority 
attention  in  the  agency.  In  addition,  the  General  Accounting  Office  has 
designated  resolution  of  the  Y2K  problem  as  a  high-risk  area,  and  DoD  has 
recognized  the  Y2K  issue  as  a  material  management  control  weakness  area  in 
the  FY  1997  Annual  Statement  of  Assurance. 

DoD  Y2K  Management  Strategy.  In  his  role  as  the  DoD  Chief  Information 
Officer  (CIO),  the  Assistant  Secretaty  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  the  “DoD  Year  2000  Management 
Plan”  (Management  Plan)  in  April  1997.  The  Management  Plan  provides  the 
overall  DoD  strategy  and  guidance  for  inventoiying,  prioritizing,  fixing,  or 
retiring  systems,  and  monitoring  progress.  The  Management  Plan  states  that  the 
DoD  Chief  Information  Officer  bias  overall  responsibility  for  overseeing  the 
DoD  solution  to  the  Y2K  problem.  Also,  the  Management  Plan  makes  the  DoD 
Components  responsible  for  the  five-phase  Y2K  management  process,  including 
awareness,  assessments,  renovations,  validations,  and  implementation  actions. 
The  Management  Plan  includes  a  description  of  &e  five-phase  Y2K 
management  process. 

The  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  is  in  the  process  of  issuing  an  updated  DoD  Management  Plan, 
which  accelerates  the  target  completion  dates  for  the  renovation,  validation,  and 
implementation  phases. 

In  a  memorandum  dated  January  20,  1998,  for  the  heads  of  executive 
departments  and  agencies,  the  Office  of  Management  and  Budget  (0MB) 
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established  a  new  target  date  for  March  1999  for  implementing  corrective 
actions  to  all  systems.  The  new  target  completion  dates  are  September  1998  for 
the  Renovation  phase  and  January  1999  for  the  Validation  phase. 


Audit  Objectives 


The  primary  objective  of  the  audit  is  to  identify  significant  time-sensitive  issues 
related  to  DoD  Y2K  reporting  requirements  and  oversight  actions  and  to  quickly 
report  those  issues  to  senior  DoD  management.  Specifically,  we  evaluated  the 
problems  in  managing  the  Defense  Integration  Support  Tools  Database  (DIST) 
and  how  DoD  can  apply  the  lessons  learned  from  &e  DIST  to  a  replacement 
database.  See  Appendix  A  for  a  discussion  of  the  scope  and  methodology  and 
for  a  summary  of  prior  coverage. 
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DoD  Year  2000  Reporting  and 
Management  Oversight 

Currently,  DoD  has  no  viable  repository  of  Y2K  information  that  DoD 
managers  can  use  for  tracking,  reporting,  monitoring,  and  overseeing 
DoD  Y2K  compliance  efforts.  Previously,  DoD  used  the  DIST  as  the 
official  repository  of  Y2K  information,  but  discontinued  it  for  Y2K  use 
because  of  national  security  concerns.  Further,  DoD  managers  were 
unable  to  rely  on  DIST  data  for  reporting  and  oversight  purposes.  The 
DIST  was  unreliable  because  the  ^ta  were  incomplete  and  inconsistent 
with  the  DoD  Component  quarterly  reports.  Consequently,  DoD 
managers  do  not  have  a  DoD-wide  automated  mechanism  for  Y2K 
reporting  and  oversight  purposes.  However,  the  DoD  CIO  has 
recognized  the  importance  of  having  a  DoD-wide  inventory  of  systems 
for  tracking  and  reporting  Y2K  efforts  and  has  taken  action  to  develop  a 
new  database  tool  to  replace  the  DIST  for  Y2K  use.  The  new  database 
tool  may  also  encounter  data  unreliability  unless  DoD  applies  the  lessons 
learned  from  the  DIST. 


Recent  Developments 

The  DoD  CIO  designated  the  DIST  as  the  official  repository  of  Y2K 
information  for  DoD.  The  DoD  CIO  intended  the  DIST  to  be  used  by  DoD 
managers  to  track  and  monitor  the  transition  to  Y2K  compliance  for  mission- 
criticd  and  odier  designated  systems.  The  DIST  was  an  unclassified  system 
until  February  4,  1998,  when  the  DoD  CIO  issued  a  memorandum  classifying 
DIST  data  as  secret.  The  decision  was  based  on  a  National  Security  Agency 
review  that  determined  that  the  vulnerability  of  the  information  in  the  DIST  was 
a  threat  to  national  security,  and  on  March  20,  1998,  the  DoD  CIO  decided 
that  DoD  would  no  longer  use  the  DIST  for  Y2K  data  reporting  requirements. 
Some  DoD  Components  relied  heavily  on  the  DIST  to  track  and  report  Y2K 
efforts  and  may  be  severely  impacted  until  a  replacement  alternative  to  the  DIST 
is  developed. 


Lessons  Learned  From  the  DIST 


In  developing  the  new  database  tool  to  replace  the  DIST  for  Y2K  use,  DoD 
should  apply  the  lessons  learned  from  the  DIST.  The  DoD  used  the  DIST  only 
minimally  for  rqiorting  and  oversight  purposes  because  the  data  were 
unreliable.  Specifically,  DIST  data  were  incomplete  and  inconsistent  with  the 
DoD  Component  quarterly  reports. 

Reporting  Requirements.  The  DoD  CIO  requires  quarterly  reports  from  the 
DoD  Components  to  obtain  the  information  needed  for  the  0MB  report.  The 
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CIO  had  intended  to  use  the  DIST  as  a  more  effective,  automated  means  of 
collecting  Y2K  information.  However,  DoD  CIO  staff  stated  that  they  did  not 
use  the  DIST  for  0MB  reporting  because  the  data  were  unreliable. 

OMB  Reporting  Requirements.  The  0MB  requires  DoD  to  submit 
a  Y2K  status  report  on  a  quarterly  basis,  due  on  the  15th  of  February,  May, 
August,  and  November  through  1999.  The  report  provides  OMB  with  a  status 
of  DoD  Y2K  compliance  efforts  and  provides  progress  information  to  Congress 
and  the  public.  To  collect  the  information  for  tihe  OMB  report,  the  DoD  CIO 
requires  DoD  Components  to  submit  a  report  to  the  DoD  CIO  on  a  quarterly 
basis,  due  on  the  18th  of  January,  April,  July,  and  October  through  1999. 

Changes  in  OMB  Reporting  Requirements.  On  January  20,  1998, 
OMB  changed  the  Y2K  reporting  requirements  for  the  quarterly  reports.  The 
OMB  revised  previous  reporting  requirements,  established  on  May  5,  1997,  by 
adding  requirements  for  data  exchanges,  contingency  planning.  Government- 
wide  systems,  and  other  evidence  of  progress.  The  DIST  replacement  database 
needs  to  be  flexible  to  allow  for  ime;q)ected  changes  in  OMB  reporting 
requirements. 

Reliability  of  DIST  Data.  We  performed  several  analyses  to  determine  the 
reliability  of  DIST  data.  Specifically,  we  analyzed  DIST  data  for  completeness 
of  data  fields  and  for  consistency  as  compared  with  the  February  1998  quarterly 
reports.  The  analyses  showed  t^t  DIST  data  were  inconsistent  and  incomplete 
for  most  DoD  Components. 

Consistency  of  DIST  Data.  We  reviewed  mission-critical  system 
data  in  the  DIST  for  15  DoD  Components.  The  15  DoD  Components 
represented  2,014  of  the  2,915  totd  mission-critical  systems  reported  by  DoD  in 
the  February  1998  quarterly  report  to  OMB.  Using  the  same  timeframe,  we 
compared  DIST  data  with  die  February  1998  reports  for  the  15  DoD 
Components.  We  extracted  the  DIST  data  on  January  21,  1998,  and  the  DoD 
CIO  received  the  quarterly  reports  between  Janua^  15  and  January  23,  1998. 

Of  the  15  DoD  Components  reviewed,  our  analysis  showed  the  following 
discrepancies. 

•  Of  the  15  DoD  Components,  14  had  an  inconsistent  number  of 
mission-critical  systems  in  the  DIST  and  the  quarterly  reports.  For  example, 
the  Air  Force  reported  191  mission-critical  systems  in  the  DIST  and  472 
mission-critical  systems  in  the  February  1998  report. 

•  Of  the  15  DoD  Components,  10  had  an  inconsistent  number  of 
Y2K-compliant  mission-critical  systenas  in  the  DIST  and  the  quarterly  reports. 
For  example,  the  Defense  Information  Systems  Agency  reported 

36  Y2K-compliant  mission-critical  systems  in  the  DIST  and  21  Y2K-compliant 
mission-critical  systems  in  the  February  1998  report, 

•  Of  die  15  DoD  Components,  13  had  an  inconsistent  number  of 
mission-critical  systems  in  the  renovation,  validation,  implementation,  and 
completed  phases  in  the  DIST  and  the  quarterly  reports.  For  example,  the 
Army  repforted  11  mission-critical  systems  in  the  renovation  pl:^e  in  the  DIST 
and  92  mission-critical  systems  in  the  renovation  phase  in  (he  February  1998 
report. 
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We  considered  the  differences  in  tibie  data  in  the  DIST  and  the  quarterly  reports 
to  be  material.  See  Appendix  B  for  the  details  of  the  analysis. 

Completeness  of  DIST  Data.  We  reviewed  the  Minimum  Required 
Data  Elements  Completeness  Report*  (the  Report)  to  determine  the  percentage 
of  complete  fields  in  the  DIST.  According  to  the  Report,  the  average 
percentage  of  complete  Y2K  data  fields  in  the  DIST  was  59  percent,  as  of 
February  4,  1998.  The  Y2K  fields  that  had  the  lowest  percentage  of 
completeness  were  as  follows: 

Y2K  Field  in  the  DIST  Percent  Complete 

Actual  Termination  Date  0.5 

Plaimed  Termination  Date  14 

Hardware  Cost  47 

Software  Budget  Shortfall  54 

According  to  DIST  staff,  the  Report  deemed  data  fields  incomplete  when  a 
blank  field  existed  in  a  data  field.  The  Report  was  made  available  to  the  DoD 
Components  to  reduce  the  number  of  blank  fields  m  the  DIST.  Details  of  the 
Report  are  included  in  Appendix  C. 


DIST  Editor  Survey  Results 


To  determine  the  cause  of  incomplete  and  inconsistent  data,  we  interviewed 
DIST  editors  for  six  DoD  Components.  DIST  editors  stated  that  the  data  were 
incomplete  and  inconsistent  widi  the  quarterly  reports  because  of  the  following: 

•  system  program  managers  did  not  provide  timely  and  accurate 
information  to  the  DIST  editors, 

•  DoD  Component  internal  databases  were  not  compatible  with  the 

DIST, 


•  DIST  data  fields  menus  did  not  consistently  provide  appropriate 
choices  for  some  entries,  and 

•  the  DIST  needed  user-fnendly  operational  improvements. 

System  Program  Managers.  The  inconsistency  of  DIST  data  and  the  quarterly 
reports  was  a  result  of  system  program  managers  reporting  inaccurate  a^ 
untimely  information  to  DIST  editors.  DIST  editors  stated  that  they  do  not 
validate  file  information  received  from  system  program  managers  to  ensure  that 


*  The  Miniimiin  Required  Data  Elements  Completeness  Report  contains  a  listing  of  DoD  Components 
and  shows  die  percentage  of  complete  data  fields  for  each  of  the  various  categories  of  information  in  the 


DIST. 
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accurate  and  consistent  data  are  entered  in  the  DIST.  The  system  program 
managers  are  a  primt^  source  of  information  for  the  status  of  Y2K  compliance. 
The  inconsistency  of  information  may  have  been  a  result  of  DIST  data  not  being 
updated  in  as  timely  a  manner  as  the  information  in  the  quarterly  reports. 
Additionally,  DIST  editors  stated  as  a  possible  reason  for  inconsistent  data  that 
the  pressure  is  on  the  system  program  managers  to  report  their  systems  on 
schedule  because  0MB  and  DoD  have  recently  moved  up  the  Y2K  compliant 
date  from  November  to  March  1999. 

Compatible  Databases.  Some  DoD  Components  maintain  an  internal  database 
for  tracking  Y2K  efforts  and  import  data  directly  from  their  database  into  the 
DIST.  Some  databases  do  not  effectively  import  data  into  the  DIST  because  the 
data  fields  are  not  compatible  with  the  DIST  data  fields.  For  example,  the 
Air  Force  uses  an  internal  database,  called  the  Air  Force  Automated  System 
Inventory  Database,  to  track  Y2K  efforts.  Die  Air  Force  database  does  not 
contain  two  DIST  fields,  “Application  Compliant”  and  “Application  Compliant 
Date. "  As  a  result,  DIST  data  are  incomplete  for  the  fields.  Additionally,  the 
Air  Force  updates  &e  DIST  on  a  monthly  basis  using  a  batch  file  update 
process.  The  DIST  editors  for  the  Air  Force  stated  fliat  the  batch  update 
process  is  labor  intensive,  which  reduces  the  frequency  of  updates  l^cause  of 
resomce  limitations.  Untimely  updates  may  cause  inconsistencies  between 
DIST  data  and  the  information  in  the  quarterly  reports. 

Appropriate  Data  Field  Menu  Choices.  The  DIST  contained  data  fields  that 
had  menu  choices  that  were  not  appropriate  for  some  entries.  For  example,  the 
DIST  data  fields  “Planned  Termination  Date”  and  “Actual  Termination  Date” 
did  not  provide  appropriate  menu  choices  and  accepted  only  a  date  entry.  DIST 
editors  stated  that  they  left  those  fields  blank  because  some  systems  were  not 
plarmed  to  be  terminated  or  had  not  been  actually  terminated.  Entries  such  as 
“not  applicable”  or  “no”  were  not  accepted  by  die  DIST  for  those  fields. 
Because  the  DIST  contained  blank  fields,  a  meaningful  completeness  analysis  of 
data  field  entries  could  not  be  performed.  The  new  replacement  database  should 
allow  for  appropriate  menu  choices  to  ensure  that  no  blank  fields  will  justifiably 
exist. 

Operational  Lnprovements.  DIST  editors  stated  that  the  DIST  needed 
operational  improvements  to  become  more  user  friendly.  The  most  common 
responses  from  DIST  editors  were  that  die  DIST  needed  a  user’s  manual  and  a 
faster  response  time  for  data  entry.  DIST  editors  needed  a  user’s  manual  to 
clarify  data  field  definitions  and  to  provide  adequate  data  entry  procedures.  A 
faster  response  time  would  allow  for  more  updates  by  reducing  resources  spent 
entering  data  in  the  DIST. 


Management  Actions 


During  our  audit,  management  took  action  to  develop  a  DIST  replacement  tool 
for  managing  the  DoD  Y2K  effort.  The  DoD  CIO  Y2K  program  office  has 
initiated  efforts  to  establish  a  database  to  collect  and  maintain  DoD  Y2K 
information.  DoD  will  use  the  new  database  to  provide  external  reports  to 
0MB  and  Congress  and  to  provide  a  current  repository  of  system  Y2K  data  for 
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oversight  purposes.  The  DoD  CIO  is  aware  of  the  need  to  implement  the 
replacement  database,  with  appropriate  controls  in  place  to  ensure  the  integrity 
of  the  data,  as  soon  as  possible. 


Conclusion 


The  DoD  CIO  needs  to  apply  the  lessons  learned  from  the  DIST  to  the 
replacement  database  to  avoid  similar  problems  of  unreliable  data.  The  DoD 
CIO  and  DoD  Components  that  relied  on  the  DIST  will  be  hampered  by  its 
absence  until  a  replacement  database  is  fully  operational.  Although  a  new 
database  is  being  developed  for  Y2K,  the  CIO  will  still  have  to  rely  on  each 
DoD  Component  to  provide  complete  and  accurate  Y2K  data. 


Recommendations,  Management  Comments,  and  Audit 
Response 

We  recommend  that  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence),  in  the  role  of  the  DoD  Chief 
Information  Officer: 

1.  Immediately  implement  a  replacement  database  for  the  Defense 
Intention  Support  Tools  Database  to  track,  monitor,  report, 
and  oversee  DoD  year  2000  efforts. 

2.  Apply  the  lessons  learned  from  the  Defense  Inflation  Support 
Tools  Database  to  the  replacement  database.  SpeciOcally,  the 
replacement  database  should: 

a.  Provide  reliable  information  for  tracking,  monitoring, 
reporting,  and  oveiseeing  DoD  year  2000  e^orts. 

b.  Provide  adequate  management  controls  for  data  entry  to 
affix  responsibility  for  accuracy  at  the  DoD  Component 
Year  2000  designated  office  level. 

c.  Allow  for  flexibility  to  accommodate  changes  in  Office  of 
Management  and  Budget  reporting  requirements. 

d.  Be  compatible  with  DoD  Component  internal  databases 
for  effective  importing  of  data. 

e.  Allow  for  appropriate  menu  choices  to  eliminate  blank 
fields. 


Management  Comments.  The  Office  of  the  Assistant  Secretaiy  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  concurred  with  all 
reconunendations  and  stated  that  the  office  had  developed  a  replacement 
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database  to  track,  monitor,  and  report  DoD  Y2K  efforts  at  a  high  level.  The 
Assistant  Secretary  also  described  several  initial  actions  already  taken  to 
implement  the  replacement  database  and  to  preclude  recognized  operational 
weaknesses  associated  with  the  DIST.  The  complete  text  of  management 
comments  is  in  Part  HI  of  this  report. 

Audit  Response.  We  consider  management  comments  to  be  generally 
responsive.  Draft  Recommendation  2.b.  included  a  requirement  for  a  high  level 
certification  of  the  validity  of  all  data  ii^iuts.  While  citing  improved 
management  controls  for  data  entry,  management  comments  on 
Recommendation  2.b.  did  not  address  whether  those  controls  include  such  a 
requirement,  but  noted  that  all  input  to  the  new  database  would  be  solely  from 
the  DoD  Component  designated  offices.  This  clearly  affixes  responsibility  for 
data  accuracy  to  diose  offices.  Therefore,  we  reworded  Recommendation  2.b. 
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Part  n  -  Additional  Information 


Appendix  A.  Audit  Process 


This  report  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  DoD  CIO,  to  monitor 
DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a  listing  of  audit 
projects  addressing  this  issue,  see  the  Y2K  webpage  on  IGnet  at 
<  http.7/www.ignet.gov  > . 


Scope 


We  reviewed  the  February  1998  Y2K  reports  in  accordance  with  CIO  reporting 
requirements  and  the  requirements  stated  in  the  Management  Plan.  We 
ev^uated  DIST  data  for  completeness  of  the  Y2K  data  fields.  We  compared  the 
DIST  data  with  the  February  1998  reports  to  determine  consistency  in 
information  reported.  We  interviewed  DoD  CIO  staff  who  are  responsible  for 
issuing  reporting  guidance  and  collecting  the  Y2K  information  from  the  DoD 
Components  and  submitting  the  information  to  0MB.  We  interviewed 
authorized  DIST  editors  who  are  responsible  for  maintaining  systems  in  the 
DIST,  and  we  interviewed  personnel  from  Electronic  Data  Services,  the 
contractor  responsible  for  the  DIST. 


Methodology 


Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  January  through  April  1998  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  Gei^ral  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  use  computer- 
processed  data  or  statistical  sampling  procedures  for  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1997  Annual 
Statement  of  Assurance.  In  addition,  the  audit  focused  on  data  in  a  database 
that  is  no  longer  used  and  its  control  weaknesses  would  not  be  included  in  future 
management  control  assurance  assessments  and  statements. 
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Summary  of  Prior  Coverage 


The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conducted  multiple  reviews  related  to  Y2K  issues.  General  Accounting  Office 
reports  can  be  accessed  over  the  Internet  at  http://www.gao.gov.  Inspector 
General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http :  //WWW.  dodig .  osd.mil. 
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Appendix  B.  Comparison  of  Defense  Integration 
Support  Tools  Database  Data  and  February  1998 
Reports 


Mission  Critical  Y2K  Compliant  Renovation  Validation  Implementation  Completed 
DIST‘  Reports^  DIST*  Reports^  DIST*  Reports^  DIST*  Reports^  D1ST‘  Reports^  DIST‘  Reports^ 


Air  Force 

191 

472 

1 

159 

75 

178 

0 

29 

39 

8 

65 

0 

Army 

395 

376 

107 

160 

11 

92 

7 

14 

52 

10 

0 

4 

BMDO 

6 

3 

0 

0 

1 

1 

1 

1 

0 

0 

0 

0 

DCAA 

1 

1 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

DeCA 

11 

9 

0 

0 

6 

6 

3 

3 

0 

0 

0 

0 

DFAS 

86 

83 

4 

12 

35 

36 

10 

12 

0 

0 

4 

0 

DISA 

99 

98 

36 

21 

38 

38 

9 

9 

4 

4 

14 

13 

DLA 

37 

33 

0 

17 

10 

6 

3 

8 

5 

1 

14 

1 

DSAA 

4 

6 

0 

0 

3 

6 

0 

0 

1 

0 

0 

0 

DSWA 

15 

9 

8 

2 

0 

1 

0 

0 

0 

2 

0 

4 

JLSC 

6 

2 

0 

0 

0 

0 

3 

2 

1 

0 

0 

0 

JS 

8 

5 

1 

0 

4 

3 

0 

0 

0 

0 

0 

0 

PACOM^ 

3 

4 

0 

0 

3 

4 

0 

0 

0 

0 

0 

0 

Navy^ 

705 

812 

8 

0 

174 

191 

253 

441 

25 

14 

213 

135 

OSIA 

3 

2 

0 

0 

0 

1 

0 

0 

0 

0 

0 

1 

WHS^ 

55 

99 

.24 

54 

19 

25 

27 

13 

9 

7 

0 

0 

Total* 

1,625 

2,014 

189 

426 

379 

588 

316 

532 

136 

46 

310 

158 

BMDO  Ballistic  Missile  Defense  Organization 
DCAA  Defense  Contract  Audit  Agency 

DeCA  Defense  Commissary  Agency 

DFAS  Defense  Finance  and  Accounting 

Service 

DISA  Defense  Information  Systems  Agency 

DLA  Defense  Logistics  Agency 


DSAA  Defense  Security  Assistance  Agency 
DSWA  Defense  Special  Weapons  Agency 

JLSC  Joint  Logistics  Support  Center 

JS  Joint  Staff 

PACOM  U.S.  Pacific  Conunand 

OSIA  On-Site  Inspection  Agency 

WHS  Washington  Headquarters  Services 


'We  extracted  the  DIST  data  on  January  21,  1998. 

^e  February  1998  quarterly  reports  were  received  by  the  DoD  CIO  from  January  15  through 
January  23,  1998. 

^For  the  unified  commands  under  Joint  Staff,  only  U.S.  Pacific  Command  had  mission-critical  systems  in 
the  DIST  for  which  they  were  listed  as  the  sponsor  component. 

^e  Navy  listing  includes  the  Marine  Corps. 

^Washington  Headquarters  Services  includes  several  DoD  Components,  including  the  Inspector  General, 
DoD;  the  Under  S^retary  of  Defense  for  Personnel  and  Readiness;  and  the  Under  Secretary  of  Defense 
for  Acquisition  and  Technology. 

^e  totals  do  not  include  the  Assistant  Secretary  of  Defense  for  Health  Affairs  and  the  DoD  intelligence 
agencies. 


14 


Appendix  C.  Completeness  Analysis  of  the 
Year  2000  Data  Fields  in  the  Defense  Integration 
Support  Tools  Database 


Percent  of  Complete  DIST  Y2K  Data  Fields 
February  1998 


Hardware  Software  Application  Application 


Compliant 

Compliant 

Comnliant 

Compliant  Date 

Phase 

Strateev 

Air  Force 

99 

99 

44 

4 

99 

88 

Army 

100 

73 

73 

73 

70 

76 

ASD(HA) 

100 

100 

99 

94 

100 

100 

BMDO 

33 

33 

33 

17 

100 

33 

DeCA 

100 

100 

100 

82 

100 

100 

DFAS 

62 

64 

94 

69 

43 

100 

DISA 

99 

99 

99 

86 

0 

0 

DLA 

86 

86 

86 

78 

86 

86 

DoDIG 

100 

100 

100 

0 

0 

50 

DSAA 

100 

100 

100 

100 

100 

100 

JLSC 

17 

83 

100 

100 

100 

50 

JS 

75 

75 

88 

75 

63 

63 

Navy 

80 

79 

78 

71 

99 

98 

OSIA 

67 

67 

67 

67 

67 

67 

USMC 

87 

85 

99 

78 

97 

81 

WHS 

100 

100 

100 

69 

100 

60 

Averages* 

90 

84 

76 

61 

85 

84 

*  The  averages  are  weighted  to  account  for  the  number  of  systems  that  each  DoD  Component  maintains  in  the 
DIST.  For  example,  die  Army  has  39S  systems  in  die  DIST  that  are  100  percent  complete  for  the  Hardware 
Compliant  data  field,  while  conversely,  the  On-Site  Inspection  Agency  has  3  systems  in  the  DIST  that  are  67 
percent  complete  for  die  same  data  field.  The  averages  take  into  account  the  varying  number  of  systems  for  each 
DoD  Conqionent. 
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Appendix  C.  Completeness  Analysis  of  the  Year  2000  Data  Fields  in  the  Defense 
Integration  Support  Tools  Database  _ 


Hardware 

Cost 

Software 

Cost 

Hardware 

Budget 

Shortfall 

Software 

Budget 

Shortfall 

Planned 

Termination 

Date 

Actual 
Termination 
Date  ^ 

Air  Force 

64 

46 

65 

46 

5 

0.5 

Army 

14 

63 

63 

64 

8 

1.0 

ASD(HA) 

95 

95 

94 

95 

97 

1.3 

BMDO 

17 

17 

17 

17 

0 

0 

DeCA 

36 

91 

82 

82 

0 

0 

DFAS 

94 

97 

94 

94 

86 

0 

DISA 

92 

94 

91 

92 

16 

0 

DLA 

81 

81 

81 

81 

0 

0 

DoDIG 

0 

0 

0 

0 

50 

0 

DSAA 

100 

100 

100 

100 

100 

0 

JLSC 

100 

100 

100 

100 

0 

0 

JS 

75 

75 

75 

75 

13 

0 

Navy 

29 

31 

28 

30 

4 

0.3 

OSIA 

33 

33 

33 

33 

0 

0 

USMC 

55 

55 

50 

53 

16 

1.3 

WHS 

96 

96 

96 

96 

0 

0 

Averages  * 

47 

54 

56 

54 

14 

0.5 

ASD(HA)  Assistant  Secretaiy  of  Defense  (Health  Affairs) 

BMDO  Ballistic  Missile  Defense  Organization 

DeCA  Defense  Commissaiy  Agency 

DFAS  Defense  Finance  and  Accounting  Service 

DISA  Defense  Information  Systems  Agency 

DLA  Defense  Logistics  Agency 

DoD  IG  Department  of  Defense,  Inspector  General 

DSAA  Defense  Security  Assistance  Agency 

JLSC  Joint  Logistics  Support  Center 

JS  Joint  Staff 

OSIA  On-Site  Inspection  Agentqr 

USMC  United  States  Marine  Corps 

WHS  Washington  Headquarters  Services 


*  See  footnote  on  previous  page. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Year  2000  Oversight  and  Contingency  Planning  Office 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Joint  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Army 
Chief  Information  Officer,  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 
Chief  Information  Officer,  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 
Chief  Information  Officer,  Air  Force 


Unified  Commands 

Commander  in  Chief,  U.S.  European  Command 
Commander  in  Chief,  U.S.  Pacific  Command 
Commander  in  Chief,  U.S.  Atlantic  Command 
Commander  in  Chief,  U.S.  Southern  Command 
Commander  in  Chief,  U.S.  Central  Command 
t  Commander  in  Chief,  U.S.  Space  Command 

Commander  in  Chief,  U.S.  Special  Operations  Command 
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Unified  Commands  (Cont’d) 


Commander  in  Chief,  U.S.  Transportation  Command 
Commander  in  Chief,  U.S.  Strategic  Command 

Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Irformation  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  Nationd  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Chief  Information  Officer,  General  Services  Administration 
Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accoimting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 
Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Iiiformation,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal  Justice, 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Office  of  Assistant  Secretary  of  Defense 
(Conunand,  Control,  Communications,  and 
Intelligence)  Comments 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 
aOOO  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-6000 

June  10,  1998 


COMHANO.  CeNTROU 
MMUNKATIOHS.  A 
■MTOJUaCNCC 


MEMORANDUM  FOR  INSPECTOR  GENERAL  OP  THE  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Audit  Report  on  OoD  Year  2000  Computing  Problem 

Reports:  Lessons  Learned  from  the  Defense  Integration 
Support  Tools  Database  (Project  No.  8AS-0017) 


This  is  in  response  to  your  request  to  review  and  connent  on 
your  May  4,  1998,  audit  report,  subject  as  above.  He  concur  with 
your  recananendations  with  cosunents.  He  feel  that  the  new  Year 
2000  (Y2K)  database  addresses  your  reconssendations  and  will 
satisfy  basic  Y2K  tracking  requirements 

He  request  that  you  Incorporate  this  memorandum  along  with 
the  attachment  in  the  final  audit  report. 


Attachment 


Arthur 
Senior  Civi 


Official 
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Office  of  Assistant  Secretary  of  Defense  (Command,  Control, 
_ Communications,  and  Intelligence)  Comments 


Response  to  OIG,  DoO,  Audit  Report,  "DoD  Year  2000  Computing 
Problem  Reports:  Lessons  Learned  from  the  Defense  Integration 
Support  Tools  Database"  16  Project  Mo.  BAS-0017,  May  4,  199B. 

Keoonandatien  #1:  Immediately  implement  a  replacement  database 
for  the  Defense  Integration  Support  Tools  database  to  track, 
monitor,  report  and  oversee  DoO  Year  2000  efforts. 

Response:  We  concur  with  the  recommendation  and  have  developed  a 
replacement  database  which  will  track,  monitor  and  report  DoD  Y2K 
efforts  at  a  high  level.  Steps  are  being  taken  to  prevent  a 
repetition  of  the  problems  associated  with  the  DIST.  The  first 
round  of  populating  the  database  occurred  in  May  1998.  On  Hay 
28,  1998,  the  Component  representatives  met  to  discuss  the  data 
fields  and  made  basic  directional  decisions  on  data  field 
modifications  and  response  options. 

AeeaadMndatlen  #2:  Apply  the  lessons  learned  from  the  Defense 
Integration  Support  Tools  Database  to  the  replacement  database. 

Response:  Ne  concur.  The  new  database  being  used  for  Y2K 
tracking  is  being  developed  with  the  contractor  that  assisted 
with  the  DIST.  The  use  of  the  former  DIST  contractor  provides 
the  technical  skills  and  corporate  knowledge  associated  with  the 
DIST  Y2K  effort  as  well  as  a  knowledge  of  the  pitfalls  and 
dangers  that  were  faced  with  the  DIST  effort. 

a.  Provide  reliable  information  for  tracking,  monitoring, 
reporting,  and  overseeing  DoO  Year  2000  efforts. 

Response:  He  concur.  The  new  database  being  used  for  Y2K 
tracking  was  developed  in  a  joint  effort  with  the  JCS,  Component 
representatives  and  Y2K  Quarterly  Report  personnel.  Input  from 
0MB  was  also  included.  The  result  is  an  improved  approach  to  the 
tracking  of  information  with  the  detailed  information  remaining 
in  the  Component  level  database. 

b.  Provide  adequate  management  controls  for  data  entry  and 
require  a  high-level  DoD  Component  official  to  certify  the 
validity  of  the  data. 

Response:  He  concur.  The  new  database  has  improved  controls  and 
will  allow  input  from  the  Conponent  y2K  designated  offices, 
eliminating  the  number  of  individual  action  officers  inputting 
data  through  the  web. 

c.  Allow  for  flexibility  to  accommodate  changes  in  the 
Office  of  Management  and  Budget  reporting  requirements. 
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Response:  We  concur.  The  new  database  maps  more  directly  to  the 
OHB  reporting  requirements  and  the  added  data  that  the  OSD  feels 
is  important  to  collect.  Some  of  the  added  data  fields, 
specifically  address  future  0MB  and/or  OSD  requirements. 

d.  Be  compatible  with  OoD  Component  internal  databases  for 
effective  importing  of  data. 

Sespons0i  He  concur.  The  Components  internally  maintained 
databases  are  being  used,  for  input  into  the  new  OSD  y2K 
database.  The  Navy  is  currently  building  it's  own  database  with 
the  requirements  and  design  of  the  OSD  YBK  database  as  the  model. 
Other  Components  databases  have  been  mapped  to  feed  the  Y2K 
database . 

e.  Allow  for  appropriate  menu  choices  to  eliminate  blank 
fields. 

Response:  He  concur.  At  the  Component  database  representative 
meeting  held  on  May  28,  1998,  a  review  of  all  the  data  fields  was 
completed.  Fields  that  were  not  of  value  or  appropriate  were 
deleted.  However,  sane  data  fields  will  remain  as  blank  entries 
in  anticipation  of  future  requirements.  . 
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